CVE-2023-49125
highpriority · track · 31EPSS 0.002 · 10 %ileDEEURUUSEPSS · scored 2026-10-27
A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < V36.0.198), Solid Edge SE2023 (All versions < V223.0 Update 11), Solid Edge SE2024 (All versions < V224.0 Update 3). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted files containing XT format. This could allow an attacker to execute code in the context of the current process.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSolid Edge SE2023siemens_psirt
Update to V223.0 Update 11 or later version
- FixedSolid Edge SE2024siemens_psirt
Update to V224.0 Update 3 or later version
- FixedParasolid V35.0siemens_psirt
Update to V35.0.263 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V35.1siemens_psirt
Update to V35.1.252 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V36.0siemens_psirt
Update to V36.0.198 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V35.0cisa_csaf_ot
Update to V35.0.263 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V35.1cisa_csaf_ot
Update to V35.1.252 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V36.0cisa_csaf_ot
Update to V36.0.198 or later version
https://support.sw.siemens.com/en-US/product/258316782/ - FixedSolid Edge SE2023cisa_csaf_ot
Update to V223.0 Update 11 or later version
- FixedSolid Edge SE2024cisa_csaf_ot
Update to V224.0 Update 3 or later version
- MitigationSolid Edge SE2023siemens_psirt
Do not open untrusted files containing XT parts in Solid Edge.
- MitigationSolid Edge SE2024siemens_psirt
Do not open untrusted files containing XT parts in Solid Edge.
- MitigationParasolid V35.0siemens_psirt
Do not open untrusted XT files in Parasolid
- MitigationParasolid V35.1siemens_psirt
Do not open untrusted XT files in Parasolid
- MitigationParasolid V36.0siemens_psirt
Do not open untrusted XT files in Parasolid
- MitigationParasolid V35.0cisa_csaf_ot
Do not open untrusted XT files in Parasolid
- MitigationParasolid V35.1cisa_csaf_ot
Do not open untrusted XT files in Parasolid
- MitigationParasolid V36.0cisa_csaf_ot
Do not open untrusted XT files in Parasolid
- MitigationSolid Edge SE2023cisa_csaf_ot
Do not open untrusted files containing XT parts in Solid Edge.
- MitigationSolid Edge SE2024cisa_csaf_ot
Do not open untrusted files containing XT parts in Solid Edge.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (25)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- SSA-382651SSA-382651: File Parsing Vulnerability in Solid Edge2024-03-12csaf · siemens_psirtDE
Solid Edge is affected by an out of bounds read vulnerability that could be triggered when the application reads files that contains XT parts. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- SSA-797296SSA-797296: XT File Parsing Vulnerability in Parasolid2024-02-13csaf · siemens_psirtDE
Parasolid is affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in XT format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ICSA-24-046-13Siemens Parasolid2024-02-13icsa · cisa_csaf_otUS
Parasolid is affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in XT format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ICSA-24-074-02Siemens Solid Edge2024-03-12icsa · cisa_csaf_otUS
Solid Edge is affected by an out of bounds read vulnerability that could be triggered when the application reads files that contains XT parts. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/html/ssa-382651.htmlcnnvd
- https://cert-portal.siemens.com/productcert/html/ssa-797296.htmlcnnvd
- https://cxsecurity.com/cveshow/CVE-2023-49125/cnnvd
- https://cert-portal.siemens.com/productcert/html/ssa-382651.htmlenisa_euvd
- https://cert-portal.siemens.com/productcert/html/ssa-797296.htmlenisa_euvd
- https://cert-portal.siemens.com/productcert/html/ssa-382651.htmlVendor Advisorynvd
- https://cert-portal.siemens.com/productcert/html/ssa-797296.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan